An emulation program and an emulation apparatus execute a target instruction, which is a bunch of instructions output from a target program, on a virtual computing machine (see, for example, Japanese translation No. 2002-543490 of PCT international application). In the following explanation, any of an emulation apparatus and a computer functioning as an emulation apparatus by execution of an emulation program is referred to as a host machine. Similarly, a set of a virtual computing machine provided through emulation and a target program operating on the virtual computing machine is referred to as a target machine.
An emulation program or an emulation apparatus is generally formed of an instruction interpreter that interprets and executes a target instruction stream and an instruction translating mechanism for translation to a host instruction at the time of execution (see, for example, Japanese translation Nos. 2002-536712 and 2006-524382 of PCT international application).
The instruction translating mechanism has a function similar to that of a conventional compiler in translating target instructions into host instructions, but is different from the conventional compiler in that the translating process is dynamic, that is, the translating process is performed at the time of executing a target program for emulation, and therefore information of the target program collectable at the time of executing the translating process can be utilized. Hereinafter, a bunch of host instructions dynamically generated by the instruction translating mechanism from the target instructions is referred to as a translation code (codelet).
The codelet is placed in a different memory region from one that emulates the target machine memory, and can be freely changed through an operation of the instruction translating mechanism or a virtual processor as long as validity of execution is ensured. This is because the codelet is considered similarly as invisible microcode in an instruction cache.
On the other hand, unlike the codelet, it is generally not allowed for the emulation program to arbitrarily rewrite data or instructions on a real memory space and a virtual memory space of the target machine. This is because it is impossible to determine such memory rewriting processes and utilities running on the target machine that refer to the rewritten memory.
In one technology, to allow a virtual memory on the target machine to be efficiently accessed from the host machine, an address translating mechanism, or Translation Lookaside Buffer (TLB), of the host machine is used to directly translate a virtual address (or a real address) of the target machine to a virtual address of the host machine. In recent years, such a technology is incorporated in many pieces of emulation software.
By using the hardware TLB of the host machine, an access overhead to the virtual memory of the target machine can be reduced significantly, comparing with using software address translation (except when TLB miss exception or page exception occurs).
In a page write-protecting method, a page attribute of the target memory is set as non-writable on the corresponding host memory. When a write in the target memory occurs, the write is detected by the host hardware and examined whether it is performed on target memory using a coordinated exception handler.
However, if such a page write-protecting method is taken, significant overheads may occur in writing not only in the region to be originally protected but also in other regions.
For example, in a low-address protection mechanism adopted by part of computers, write protection works for writing in addresses in a range of 0 to 511, while these machines support only limited page sizes: 2KB or larger. Writes in addresses of 512 onward on the same page may be occurred as many as those on other pages.
When a target machine supporting low-address protection is emulated by a host machine not supporting low-address protection but using page write protection, write protection is required to be performed also for the addresses of 512 onward on the same page to replicate low-address protection. Therefore, compared with the original execution environment of the target machine, write protection violations increase.
Moreover, there is another problem of ensuring coherency of instruction. Several methods of ensuring coherency of codelets and corresponding target instructions have been known. One of such ensuring methods is a write protection method based on a page write protection method.
In the write protection method based on the page write protection method, a memory page including target instructions associated with codelet is set to a write protection attribute. When a write is performed in the protected page, any codelet for the target instruction in this page becomes invalid, or a particular codelet becomes invalid after examined each validity individually. Since protection is performed in units of pages, the write protection mechanism works even in writing in data addresses on the same page that are not included in the target instructions.
When a write protection violation is detected by the host machine, an exception handler of a host operating system (OS) kernel or an emulation program is started. The exception handler checks to see whether this write is targeted for a region to be originally protected. If this write is targeted for a region not to be exactly protected, the exception handler operates the TLB of the host processor to invalidate write protection to allow the write in the memory. Then, the exception handler again operates the TLB of the host processor to validate write protection.
Compared with the original write instruction, the privileged operation of the host TLB by execution of the exception handler is extremely slow due to significant overheads. However, such overheads occur only for a store instruction causing a protection violation.
An instruction interpreter can be used for write protection without using the page write protecting function of the host machine. However, in write protection with the instruction interpreter, whether a write address is within a protected region has to be determined for all store instructions included in a bunch of target instructions. This causes overheads for almost all store instructions regardless of the presence or absence of a protection violation, meaning that the entire performance is degraded in proportion to the number of times of execution of store instructions.
That is, in the conventional technology, when a virtual execution environment is provided to a target program, memory protection and high-speed access are not mutually compatible.